Top Risks

• webRequest + <all_urls>: intercepts all HTTP traffic on every site visited — high capability surface.
• Developer email is a Google Groups address (not a verified org domain); no verified publisher badge.
• Privacy policy scoped to this extension but admits third-party sharing without detailing recipients.
• 400K installs amplify blast radius if extension were ever compromised or transferred.
• js_external_hosts include documentation domains that could change ownership (e.g. schemas.xmlsoap.org).

Evidence

• permissions_high manifest webRequest + <all_urls>: full request interception on all sites; justified for SAML debugger category.
• justified_broad_discount manifest DeveloperTools SAML debugger — broad host+webRequest matches stated function; -1.5 discount applied.
• csp_present_strict manifest Strict CSP: default-src 'none'; script-src 'self' only. No remote code loading permitted.
• code_clean crx 16 JS files scanned; code_findings_raw empty; obfuscation_score 0.0; no CVEs detected.
• privacy_third_party_sharing api Policy fetched, scoped, no data collection claimed, but third_party_sharing==true; +1.0 penalty.
• developer_identity store Dev email googlegroups.com; no verified publisher; developer_name SimpleSAMLphp (known OSS project).
• no_bad_hosts_no_monetization api bad_host_hits, monetization_hits, affiliate_hits all empty; no threat-intel flags.
• maintenance_current store Last updated August 2026; months_since_update=1; maintenance score 0.0.

Permissions Breakdown

• webRequest high Intercepts all HTTP requests across all URLs; core to SAML debugging but high capability.
• <all_urls> (host_permission) high Broad host access paired with webRequest enables full request inspection on every site.

Pillar Scores

Bookkeeping